mfacord@1.0.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

mfacord@1.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

lib/cache.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = lib/cache.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fdab71fb1800a0c1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = discord-mfa@3.0.1 matchedPath = lib/cache.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/cache.jsView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = index.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = lib/http.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Source & flagged code

6 flagged

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

lib/cache.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = lib/cache.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fdab71fb1800a0c1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = discord-mfa@3.0.1 matchedPath = lib/cache.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/cache.jsView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = index.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = discord-mfa@3.0.1 matchedPath = lib/http.js matchedIdentity = npm:ZGlzY29yZC1tZmE:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg